The Liberty Alliance Project (LAP) was formed to develop open standards for federated network identity management and identity-based services and is working to support the privacy and security of identity information between businesses and individuals. The LAP does not develop products or services, but defines standards to which other organizations comply. The goal is to simplify transactions on the Internet, where user accounts are proliferating, by allowing users to link elements of their identity between accounts without centrally storing all of their personal information. The LAP specifications are oriented to the identification of a user to a service provider using an Identity Provider (IDP).
The LAP specification defines service providers as “an entity that provides services and/or goods to Principals.” The LAP specification further defines principals as “an entity that can acquire a federated identity, that is capable of making decisions, and to which authenticated actions are done on its behalf. Examples of principals include an individual user, a group of individuals, a corporation, other legal entities, or a component of the Liberty architecture.” In the LAP specification, an identity provider is defined as a “Liberty-enabled entity that creates, maintains, and manages identity information for Principals and provides Principal authentication to other service providers within a circle of trust”. In the LAP specification, a Liberty-enabled client is defined as an “entity that has, or knows how to obtain, knowledge about the identity provider that the Principal wishes to use with the service provider.” The Liberty Identity Federation Framework (ID-FF) architecture overview states “when users interact with services on the Internet, they often tailor the services in some way for their personal use. For example, a user may establish an account with a username and password and/or set some preferences for what information the user wants displayed and how the user wants it displayed. The network identity of each user is the overall global set of these attributes constituting the various accounts.”
The user can have a single identity that enables a variety of services. Conversely, a user may have multiple identities that are used with different service providers. In the LAP specification, cookies are offered as a means for providing the appropriate identity to each service provider when required. Cookies are a message given to a Web browser by a Web server and are stored in a text file on a user's computer. The message is sent back to the Web server each time the Web browser requests a page from that Web server. International Application Number PCT/US02/38575 discloses use of cookies to provide the appropriate identity to each service provider. Cookies, however, may be either inadvertently or purposefully deleted. Additionally, cookies may or may not be allowed when browsing the Internet from some devices. Cookies also pose security issues. If session authentication information is cached in a persistent cookie (a cookie that is not deleted when the user logs out from the system), and a second user logs into the system and launches the browser, the second user can impersonate the first user through the cookies.
What is needed, therefore, is a more reliable and more secure method for easily providing the appropriate identity to each service provider. What is further needed is a method of automatically responding to an authentication request from a service provider without user intervention. What is still further needed is a method that allows a user to select the IDP that provides the authentication response to a service provider authentication request.